Ack3 puts crypto losses from cyber attacks at about $940 million in the first half of 2026

The cybersecurity research firm Ack3, in a report picked up by capital market media on Monday, 3 August 2026 (12 Mordad 1405), confirmed 135 security incidents and exploits between January and June 2026 causing total losses of $939.86 million. The average loss per incident was about $6.96 million.

According to the report, 94.4% of the assets stolen from projects that had undergone security audits were taken through paths that fell outside the auditors' scope. Most of the damage traces to two large events: the Kelp DAO protocol and the rsETH token lost $292 million in April 2026 after attackers compromised the sole verifier of LayerZero cross-chain messages and forged a message, and two weeks earlier the Drift perpetuals platform on the Solana network lost $285 million. Together those two events account for $577 million, or about 61% of all assets stolen in the first half of the year.

A similar pattern appears elsewhere: Step Finance with $40 million, Humanity Protocol with $32 million and Resolv's USR stablecoin with $24.5 million were all hit through theft or misuse of private keys and digital signing infrastructure rather than through flaws in smart contracts. Cross-chain bridges also remain vulnerable, with Verus losing $11.5 million, Syscoin $8 million and Taiko $1.7 million. The Truebit project lost $26.4 million because of an integer overflow error in its token pricing mechanism.